Why BIOS is not asking for HDD password on reboot but only after power off?

Question

I was reading about BIOS and I saw this:

Next, BIOS will begin checking memory at 0000:0472h. This address contains a flag which will tell the BIOS if the system is booting from a cold boot or warm boot.

As you can see, it tells that the BIOS has 2 types to check the booting process. It says when the BIOS finds a warm boot (value 1234h) it will skip the POST routines remaining, however if the BIOS finds a cold boot, the remaining POST routines will be run.

Now, supposing that I have a password in the startup (user password set in the BIOS) of the system and a hard disk.

When I power up the computer, this means that the BIOS will read for a cold boot and will run the remaining POST routines, and of course will ask for the user's and hard disk's password. But when I reboot the system from the operating system (in this case, a Linux distribution), why doesn't the BIOS requests for the hard disk's password? Does this means that the BIOS is reading now a warm boot?

Answer 1

Your quote is about the old legacy BIOS (16-bit). Nowadays most BIOSes implement UEFI-compliant firmware, which works in a pretty different way. The Opal specification published by TCG, describes how the UEFI firmware interacts with self-encrypting harddrives. However, it seems your scenario is not really BIOS-related. According to ArchLinux wiki on the topic :

Typical self-encrypting drives, once unlocked, will remain unlocked as long as power is provided. This vulnerability can be exploited by means of altering the environment external to the drive, without cutting power, in effect keeping the drive in an unlocked state. For example, it has been shown (by researchers at Universiy of Erlangen-Nuremberg) that it is possible to reboot the computer into an attacker-controlled operating system without cutting power to the drive. The researchers have also demonstrated moving the drive to another computer without cutting power

So it's probably the drive itself, and not the BIOS/firmware, which is caching the password on warm reboot.

Other references:

• UEFI Plugfest: Strategies for Firmware Support of Self-Encrypting Drives

• EDK2's SecurityPkg implements various Opal-related functionality, e.g. 1, 2